[Bug 204358] zfs loader zfs_probe_args secsz is too small, causing memory corruption

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204358

--- Comment #2 from commit-hook at freebsd.org ---
A commit references this bug:

Author: allanjude
Date: Mon Jan 11 15:35:30 UTC 2016
New revision: 293661
URL: https://svnweb.freebsd.org/changeset/base/293661

Log:
  DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args
  member secsz was a uint16_t

  sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a
  uint16_t for media sector size; it is used as an argument for ioctl()
  at line 484. however, this ioctl writes 32 bits of data (u_int *) and
  therefore this ioctl will overwrite and corrupt 16 bits of memory.
  other use cases seem to use correct u_int type for secsz.

  PR:           204358
  Submitted by: Toomas Soome <tsoome at me.com>
  Reviewed by:  asomers, delphij, smh
  MFC after:    5 days
  Differential Revision:        https://reviews.freebsd.org/D4811

Changes:
  head/sys/boot/zfs/zfs.c

-- 
You are receiving this mail because:
You are the assignee for the bug.